Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1NetSupport...03.zip
windows7-x64
1NetSupport...03.zip
windows10-2004-x64
1Client32.ini
windows7-x64
1Client32.ini
windows10-2004-x64
1NSM.lic
windows7-x64
3NSM.lic
windows10-2004-x64
3NSS.ini
windows7-x64
1NSS.ini
windows10-2004-x64
1NetSupport...03.exe
windows7-x64
10NetSupport...03.exe
windows10-2004-x64
10NetSupportInstall.bat
windows7-x64
10NetSupportInstall.bat
windows10-2004-x64
10client32u.ini
windows7-x64
1client32u.ini
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 13:56
Static task
static1
Behavioral task
behavioral1
Sample
NetSupport School Student 15.10.0003.zip
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
NetSupport School Student 15.10.0003.zip
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
Client32.ini
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Client32.ini
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
NSM.lic
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
NSM.lic
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
NSS.ini
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
NSS.ini
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
NetSupport School 15.10.0003.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
NetSupport School 15.10.0003.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
NetSupportInstall.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
NetSupportInstall.bat
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
client32u.ini
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
client32u.ini
Resource
win10v2004-20250129-en
General
-
Target
NetSupportInstall.bat
-
Size
66B
-
MD5
c64fd547b11cc65bfbb93bdbfa750eef
-
SHA1
216ce7fa10a536b32b868746da7b970382c61453
-
SHA256
7994b920cb245256765becf9fe5bd8e09b3525814846eed4296204b454303a15
-
SHA512
60afdc2621be2491eaa4ddda0c1f7aa689c18a022646292afed94d92a8344622bc05c36738724dbedcc1c5310ad57890e1ab9142b06c5f9127e5bedb987a2179
Malware Config
Signatures
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Netsupport family
-
Drops file in Drivers directory 6 IoCs
description ioc Process File created C:\Windows\system32\drivers\pcisys.sys winst64.exe File created C:\Windows\system32\drivers\nskbfltr.sys winst64.exe File created C:\Windows\system32\drivers\nskbfltr2.sys winst64.exe File opened for modification C:\Windows\system32\DRIVERS\SET5F4F.tmp DrvInst.exe File created C:\Windows\system32\DRIVERS\SET5F4F.tmp DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\gdihook5.sys DrvInst.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\nskbfltr\ImagePath = "\\SystemRoot\\system32\\drivers\\nskbfltr.sys" MSI54FB.tmp -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 17 IoCs
pid Process 2160 MSI461E.tmp 1988 MSI464E.tmp 2904 MSI4B94.tmp 2612 checkdvd.exe 2652 MSI549C.tmp 2940 MSI54FB.tmp 2160 winst64.exe 2428 pcicfgui_setup.exe 1512 pcicfgui_setup.exe 2716 MSI67B4.tmp 2500 client32.exe 2496 MSI6C29.tmp 1996 client32.exe 2848 runplugin.exe 2904 runplugin64.exe 2592 runplugin.exe 2520 runplugin64.exe -
Loads dropped DLL 64 IoCs
pid Process 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2800 msiexec.exe 2220 MsiExec.exe 2220 MsiExec.exe 2220 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe 1052 MsiExec.exe 2800 msiexec.exe 2800 msiexec.exe 1052 MsiExec.exe 2940 MSI54FB.tmp 2160 winst64.exe 2940 MSI54FB.tmp 1052 MsiExec.exe 2220 MsiExec.exe 2428 pcicfgui_setup.exe 2428 pcicfgui_setup.exe 2428 pcicfgui_setup.exe 2428 pcicfgui_setup.exe 2428 pcicfgui_setup.exe 2428 pcicfgui_setup.exe 2500 client32.exe 2500 client32.exe 2500 client32.exe 2500 client32.exe 2500 client32.exe 2500 client32.exe 2500 client32.exe 2500 client32.exe 2500 client32.exe 2220 MsiExec.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2800 msiexec.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\R: runplugin64.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: runplugin.exe File opened (read-only) \??\F: runplugin64.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: runplugin64.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: runplugin.exe File opened (read-only) \??\E: runplugin64.exe File opened (read-only) \??\V: runplugin64.exe File opened (read-only) \??\Z: runplugin64.exe File opened (read-only) \??\G: runplugin.exe File opened (read-only) \??\K: runplugin.exe File opened (read-only) \??\W: runplugin.exe File opened (read-only) \??\X: runplugin.exe File opened (read-only) \??\V: runplugin.exe File opened (read-only) \??\B: runplugin64.exe File opened (read-only) \??\L: runplugin64.exe File opened (read-only) \??\W: runplugin64.exe File opened (read-only) \??\Y: runplugin64.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\S: runplugin.exe File opened (read-only) \??\F: runplugin.exe File opened (read-only) \??\H: runplugin64.exe File opened (read-only) \??\J: runplugin64.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\X: runplugin64.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\O: runplugin.exe File opened (read-only) \??\K: runplugin64.exe File opened (read-only) \??\T: runplugin64.exe File opened (read-only) \??\Z: runplugin.exe File opened (read-only) \??\M: runplugin64.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: runplugin.exe File opened (read-only) \??\H: runplugin.exe File opened (read-only) \??\J: runplugin.exe File opened (read-only) \??\N: runplugin64.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: runplugin.exe File opened (read-only) \??\U: runplugin.exe File opened (read-only) \??\Y: runplugin.exe File opened (read-only) \??\G: runplugin64.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: runplugin.exe File opened (read-only) \??\Q: runplugin.exe File opened (read-only) \??\R: runplugin.exe File opened (read-only) \??\Q: runplugin64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: runplugin.exe File opened (read-only) \??\N: runplugin.exe File opened (read-only) \??\A: runplugin64.exe File opened (read-only) \??\U: runplugin64.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "0" MSI54FB.tmp -
Drops file in System32 directory 33 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File created C:\Windows\SysWOW64\pcimsg.dll MSI54FB.tmp File opened for modification C:\Windows\SysWOW64\pcimsg.dll MSI54FB.tmp File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\SET5E0A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\x64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat winst64.exe File created C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\SET5E0A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\SET5E0B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstor.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\gdihook5.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infpub.dat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\x64\SET5DF9.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\gdihook5.inf_amd64_neutral_d8853853669e565a\gdihook5.PNF DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt winst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\x64\gdihook5.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\SET5E0B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\gdihook5.inf_amd64_neutral_d8853853669e565a\gdihook5.PNF DrvInst.exe File opened for modification C:\Windows\system32\SET5FAE.tmp DrvInst.exe File opened for modification C:\Windows\system32\gdihook5.dll DrvInst.exe File created C:\Windows\system32\clhook4.dll winst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\x64\SET5DE9.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\x64\gdihook5.dll DrvInst.exe File created C:\Windows\system32\client32provider.dll winst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\gdihook5.cat DrvInst.exe File created C:\Windows\System32\DriverStore\INFCACHE.0 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat winst64.exe File created C:\Windows\system32\SET5FAE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\infstrng.dat DrvInst.exe File opened for modification C:\Windows\system32\clhook4.dll winst64.exe File created C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\x64\SET5DE9.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{22f762fb-26f6-61ba-3ac0-b0595ac1a117}\x64\SET5DF9.tmp DrvInst.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2428 pcicfgui_setup.exe 2428 pcicfgui_setup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\NetSupport\NetSupport School\ReportDb.htf msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\x64\gdihook5.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\ShowAnswer.wav msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\NSSilence.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PlaySound.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-console-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-file-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-conio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\NSSecurity.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-stdio-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\DBI.EXE msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\nskbfltr2.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\Client32Provider.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\StudentIncorrect.wav msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\clientRestarter.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pciver.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\Control.kbd msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\TCCTL32.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\mfc140u.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-math-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PCIAPPCTRL.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-localization-l1-2-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pcicapi.DLL msiexec.exe File opened for modification C:\Program Files (x86)\NetSupport\NetSupport School\Client32u.ini pcicfgui_setup.exe File created C:\Program Files (x86)\Common Files\NSL\NSCommonHook64.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\wxpdfdoc.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\setroom.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\nskbfltr.sys msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\gdihook5.INF msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\image_name.jpg msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\nssplayercore.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\libcrypto-1_1.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\gdihook5.cat msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\toastImageAndText.png msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-debug-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-synch-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-environment-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\keyShow64.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\nssres_200.dll msiexec.exe File created C:\Program Files (x86)\Common Files\NSL\winstHooks64.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\wxmsw322u_core_vc_custom.dll msiexec.exe File opened for modification C:\Program Files (x86)\NetSupport\NetSupport School\sec.log SecEdit.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-memory-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\vccorlib140.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pciappctrl64.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\icudt51.dll msiexec.exe File opened for modification C:\Program Files (x86)\NetSupport\NetSupport School\_Data.lnk MSI54FB.tmp File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-string-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PCIMSG.DLL msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\keyshowhook.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-profile-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-crt-time-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\Common Files\NSL\nslsp.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\nspowershell.exe msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\api-ms-win-core-handle-l1-1-0.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\weblock.jpg msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\Sounds\StudentPicked.wav msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\vcruntime140.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\pluginprintmanmodule64.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\x64\gdihook5.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PciHooks64.dll msiexec.exe File created C:\Program Files (x86)\NetSupport\NetSupport School\PluginSoftwareModule64.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI3DCA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI499B.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut5_0CEE40B1A09F47C29DE0582B6A44A9EC_1.exe msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\VideoShortcutWin7Abo_484D413D0D3342A2A692F037061C1AA9.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.app.log winst64.exe File opened for modification C:\Windows\setuperr.log winst64.exe File created C:\Windows\INF\oem2.PNF DrvInst.exe File opened for modification C:\Windows\setupact.log MSI54FB.tmp File opened for modification C:\Windows\Installer\f773517.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI3ED8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3F67.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4082.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4464.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI49EA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4AB8.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcinssui.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut3_80D45F4DD8E3472CB2C7080AAA34AB2A.exe msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut1_1045CC3CC07549BB86C478A6B724F98D.exe msiexec.exe File opened for modification C:\Windows\setupact.log winst64.exe File opened for modification C:\Windows\Installer\MSI3E09.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3EA8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI45AF.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcinssui.exe1_28874BA5F8594ADCBE8AB571ECB4C1AB.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSI67B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3E39.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI457F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4AC9.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut5_0CEE40B1A09F47C29DE0582B6A44A9EC_1.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI640B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3F46.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI460D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4DD7.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcinssui.exe1_28874BA5F8594ADCBE8AB571ECB4C1AB.exe msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\setuperr.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI3BC1.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI4A79.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\schdesigner.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI4005.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\pcideply.exe_5E9E1DA4475445BE9255D1E30AFF412C.exe msiexec.exe File opened for modification C:\Windows\INF\oem2.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f773519.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3CAE.tmp msiexec.exe File created C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\ARPPRODUCTICON.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI40F1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4339.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI43A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4425.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut3_80D45F4DD8E3472CB2C7080AAA34AB2A.exe msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\NewShortcut8_134A4E1756504D7CA2A1E16C4AA879D9.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI549C.tmp msiexec.exe File created C:\Windows\Installer\f773514.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3C7E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI42BB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI44C3.tmp msiexec.exe File opened for modification C:\Windows\setuperr.log MSI54FB.tmp File opened for modification C:\Windows\Installer\MSI3D6B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3FE4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI461E.tmp msiexec.exe File opened for modification C:\Windows\Installer\{F021B863-9473-4467-93B2-6FC48C30E42F}\VideoShortcutWin7Abo_484D413D0D3342A2A692F037061C1AA9.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI54FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSIEXEC.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI549C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI464E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI67B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI4B94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language client32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runplugin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NetSupport School 15.10.0003.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pcicfgui_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language runplugin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language checkdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecEdit.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\powrprof.dll,-15 = "Balanced" client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E client32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 client32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates winst64.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs winst64.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\DefaultIcon msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ThreadingModel = "Apartment" winst64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\943C1EEA70369E845B409AAF32BEB8CD\368B120F37497644392BF64CC8034EF2 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\PackageName = "NetSupport School.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{6A1875C5-8753-4372-A8BF-C58D98E5AC91}\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\ConfiguratorShortcut = "Configurator" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\InstalledBySetup = "Common" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\943C1EEA70369E845B409AAF32BEB8CD msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\DefaultIcon\ = "C:\\Program Files (x86)\\NetSupport\\NetSupport School\\PCIVideo.exe,1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.rpf\ = "NSReplayFile" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\command MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\ = "&Show with NetSupport School" MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Nb77a9716\a = "S" MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Nb77a9716 MSI549C.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\Temp = "NSS" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\Version = "252313603" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\NSS msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\Common = "NSS" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\"" MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692}\InProcServer32\ = "Client32Provider.dll" winst64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Nb77a9716 MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\"" MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\"" MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command MSI54FB.tmp Key created \REGISTRY\MACHINE\Software\Classes\.rpf msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell\Play\Command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\client32.exe\" /r\"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\ProductName = "NetSupport School" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{6A1875C5-8753-4372-A8BF-C58D98E5AC91}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\ = "NetSupport School Replay File" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile\shell\show\ = "&Show with NetSupport School" MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\ = "&Show with NetSupport School" MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\Media\1 = "DISK1;1" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile\Shell msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show\command MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\PackageCode = "FB5CF6184E1C03947993AD8D0BD0DFCB" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\AuthorizedLUAApp = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\shell\show MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\368B120F37497644392BF64CC8034EF2\Configurator = "NSS" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\ProductIcon = "C:\\Windows\\Installer\\{F021B863-9473-4467-93B2-6FC48C30E42F}\\ARPPRODUCTICON.exe" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\368B120F37497644392BF64CC8034EF2\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shell\show\ = "&Show with NetSupport School" MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMVFile\shell\show MSI54FB.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71C5A887-11E0-4c5a-9B9B-D4A074555692} winst64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NSReplayFile\Shell msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\NSReplayFile msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ASFFile MSI54FB.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\movfile\shell\show\command\ = "\"C:\\Program Files (x86)\\NetSupport\\NetSupport School\\pcinssui.exe\" /ShowVideo \"%L\"" MSI54FB.tmp -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1996 client32.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 4 IoCs
pid Process 2756 NetSupport School 15.10.0003.exe 2416 attrib.exe 2584 attrib.exe 1852 SecEdit.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2220 MsiExec.exe 2800 msiexec.exe 2800 msiexec.exe 2940 MSI54FB.tmp 2940 MSI54FB.tmp 2940 MSI54FB.tmp 2940 MSI54FB.tmp 2500 client32.exe 2500 client32.exe 1996 client32.exe 1996 client32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2848 runplugin.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2556 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2556 MSIEXEC.EXE Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeSecurityPrivilege 2800 msiexec.exe Token: SeCreateTokenPrivilege 2556 MSIEXEC.EXE Token: SeAssignPrimaryTokenPrivilege 2556 MSIEXEC.EXE Token: SeLockMemoryPrivilege 2556 MSIEXEC.EXE Token: SeIncreaseQuotaPrivilege 2556 MSIEXEC.EXE Token: SeMachineAccountPrivilege 2556 MSIEXEC.EXE Token: SeTcbPrivilege 2556 MSIEXEC.EXE Token: SeSecurityPrivilege 2556 MSIEXEC.EXE Token: SeTakeOwnershipPrivilege 2556 MSIEXEC.EXE Token: SeLoadDriverPrivilege 2556 MSIEXEC.EXE Token: SeSystemProfilePrivilege 2556 MSIEXEC.EXE Token: SeSystemtimePrivilege 2556 MSIEXEC.EXE Token: SeProfSingleProcessPrivilege 2556 MSIEXEC.EXE Token: SeIncBasePriorityPrivilege 2556 MSIEXEC.EXE Token: SeCreatePagefilePrivilege 2556 MSIEXEC.EXE Token: SeCreatePermanentPrivilege 2556 MSIEXEC.EXE Token: SeBackupPrivilege 2556 MSIEXEC.EXE Token: SeRestorePrivilege 2556 MSIEXEC.EXE Token: SeShutdownPrivilege 2556 MSIEXEC.EXE Token: SeDebugPrivilege 2556 MSIEXEC.EXE Token: SeAuditPrivilege 2556 MSIEXEC.EXE Token: SeSystemEnvironmentPrivilege 2556 MSIEXEC.EXE Token: SeChangeNotifyPrivilege 2556 MSIEXEC.EXE Token: SeRemoteShutdownPrivilege 2556 MSIEXEC.EXE Token: SeUndockPrivilege 2556 MSIEXEC.EXE Token: SeSyncAgentPrivilege 2556 MSIEXEC.EXE Token: SeEnableDelegationPrivilege 2556 MSIEXEC.EXE Token: SeManageVolumePrivilege 2556 MSIEXEC.EXE Token: SeImpersonatePrivilege 2556 MSIEXEC.EXE Token: SeCreateGlobalPrivilege 2556 MSIEXEC.EXE Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe Token: SeRestorePrivilege 2800 msiexec.exe Token: SeTakeOwnershipPrivilege 2800 msiexec.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1996 client32.exe 1996 client32.exe 1996 client32.exe 1996 client32.exe 1996 client32.exe 1996 client32.exe 1996 client32.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1996 client32.exe 1996 client32.exe 1996 client32.exe 1996 client32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2848 runplugin.exe 2904 runplugin64.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2756 2636 cmd.exe 31 PID 2636 wrote to memory of 2756 2636 cmd.exe 31 PID 2636 wrote to memory of 2756 2636 cmd.exe 31 PID 2636 wrote to memory of 2756 2636 cmd.exe 31 PID 2636 wrote to memory of 2756 2636 cmd.exe 31 PID 2636 wrote to memory of 2756 2636 cmd.exe 31 PID 2636 wrote to memory of 2756 2636 cmd.exe 31 PID 2756 wrote to memory of 2556 2756 NetSupport School 15.10.0003.exe 32 PID 2756 wrote to memory of 2556 2756 NetSupport School 15.10.0003.exe 32 PID 2756 wrote to memory of 2556 2756 NetSupport School 15.10.0003.exe 32 PID 2756 wrote to memory of 2556 2756 NetSupport School 15.10.0003.exe 32 PID 2756 wrote to memory of 2556 2756 NetSupport School 15.10.0003.exe 32 PID 2756 wrote to memory of 2556 2756 NetSupport School 15.10.0003.exe 32 PID 2756 wrote to memory of 2556 2756 NetSupport School 15.10.0003.exe 32 PID 2800 wrote to memory of 2220 2800 msiexec.exe 34 PID 2800 wrote to memory of 2220 2800 msiexec.exe 34 PID 2800 wrote to memory of 2220 2800 msiexec.exe 34 PID 2800 wrote to memory of 2220 2800 msiexec.exe 34 PID 2800 wrote to memory of 2220 2800 msiexec.exe 34 PID 2800 wrote to memory of 2220 2800 msiexec.exe 34 PID 2800 wrote to memory of 2220 2800 msiexec.exe 34 PID 2800 wrote to memory of 2648 2800 msiexec.exe 35 PID 2800 wrote to memory of 2648 2800 msiexec.exe 35 PID 2800 wrote to memory of 2648 2800 msiexec.exe 35 PID 2648 wrote to memory of 2416 2648 cmd.exe 37 PID 2648 wrote to memory of 2416 2648 cmd.exe 37 PID 2648 wrote to memory of 2416 2648 cmd.exe 37 PID 2648 wrote to memory of 2416 2648 cmd.exe 37 PID 2800 wrote to memory of 2564 2800 msiexec.exe 38 PID 2800 wrote to memory of 2564 2800 msiexec.exe 38 PID 2800 wrote to memory of 2564 2800 msiexec.exe 38 PID 2564 wrote to memory of 2584 2564 cmd.exe 40 PID 2564 wrote to memory of 2584 2564 cmd.exe 40 PID 2564 wrote to memory of 2584 2564 cmd.exe 40 PID 2564 wrote to memory of 2584 2564 cmd.exe 40 PID 2800 wrote to memory of 2160 2800 msiexec.exe 41 PID 2800 wrote to memory of 2160 2800 msiexec.exe 41 PID 2800 wrote to memory of 2160 2800 msiexec.exe 41 PID 2800 wrote to memory of 1988 2800 msiexec.exe 43 PID 2800 wrote to memory of 1988 2800 msiexec.exe 43 PID 2800 wrote to memory of 1988 2800 msiexec.exe 43 PID 2800 wrote to memory of 1988 2800 msiexec.exe 43 PID 2800 wrote to memory of 1988 2800 msiexec.exe 43 PID 2800 wrote to memory of 1988 2800 msiexec.exe 43 PID 2800 wrote to memory of 1988 2800 msiexec.exe 43 PID 2800 wrote to memory of 1052 2800 msiexec.exe 44 PID 2800 wrote to memory of 1052 2800 msiexec.exe 44 PID 2800 wrote to memory of 1052 2800 msiexec.exe 44 PID 2800 wrote to memory of 1052 2800 msiexec.exe 44 PID 2800 wrote to memory of 1052 2800 msiexec.exe 44 PID 2800 wrote to memory of 1052 2800 msiexec.exe 44 PID 2800 wrote to memory of 1052 2800 msiexec.exe 44 PID 2800 wrote to memory of 2904 2800 msiexec.exe 45 PID 2800 wrote to memory of 2904 2800 msiexec.exe 45 PID 2800 wrote to memory of 2904 2800 msiexec.exe 45 PID 2800 wrote to memory of 2904 2800 msiexec.exe 45 PID 2800 wrote to memory of 2904 2800 msiexec.exe 45 PID 2800 wrote to memory of 2904 2800 msiexec.exe 45 PID 2800 wrote to memory of 2904 2800 msiexec.exe 45 PID 2800 wrote to memory of 2612 2800 msiexec.exe 46 PID 2800 wrote to memory of 2612 2800 msiexec.exe 46 PID 2800 wrote to memory of 2612 2800 msiexec.exe 46 PID 2800 wrote to memory of 2612 2800 msiexec.exe 46 PID 2800 wrote to memory of 2652 2800 msiexec.exe 47 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2416 attrib.exe 2584 attrib.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\NetSupportInstall.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\NetSupport School 15.10.0003.exe"NetSupport School 15.10.0003" /S /v/qn2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\MSIEXEC.EXE"C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\Admin\AppData\Local\Temp\{6A1875C5-8753-4372-A8BF-C58D98E5AC91}\NetSupport School.msi" /qn SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="NetSupport School 15.10.0003.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Loads dropped DLL
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 85B431DC22CF5E81DFBAC120A333DB962⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2220
-
-
C:\Windows\system32\cmd.execmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\nsm.lic2⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\attrib.exeATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\nsm.lic3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Views/modifies file attributes
PID:2416
-
-
-
C:\Windows\system32\cmd.execmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\nsm.lic2⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\attrib.exeATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\nsm.lic3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Views/modifies file attributes
PID:2584
-
-
-
C:\Windows\Installer\MSI461E.tmp"C:\Windows\Installer\MSI461E.tmp" /p "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\\Detect64LSP.txt"2⤵
- Executes dropped EXE
PID:2160
-
-
C:\Windows\Installer\MSI464E.tmp"C:\Windows\Installer\MSI464E.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1988
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D35EA5ADDE2717247476BB7B18B6C00E M Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1052
-
-
C:\Windows\Installer\MSI4B94.tmp"C:\Windows\Installer\MSI4B94.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EU2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\checkdvd.exe"C:\Program Files (x86)\NetSupport\NetSupport School\checkdvd.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612
-
-
C:\Windows\Installer\MSI549C.tmp"C:\Windows\Installer\MSI549C.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EC /Q /Q /C2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2652
-
-
C:\Windows\Installer\MSI54FB.tmp"C:\Windows\Installer\MSI54FB.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EV"NetSupport School" /EC /Q /Q /I *2⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2940 -
C:\Program Files (x86)\NetSupport\NetSupport School\winst64.exewinst64.exe /q /q /i3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2160
-
-
-
C:\Windows\system32\cmd.execmd.exe /c secedit /configure /areas SECURITYPOLICY /db hisecws.sdb /cfg "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\NS.inf" /log "C:\Program Files (x86)\NetSupport\NetSupport School\sec.log" /overwrite /quiet2⤵PID:912
-
C:\Windows\SysWOW64\SecEdit.exesecedit /configure /areas SECURITYPOLICY /db hisecws.sdb /cfg "C:\Users\Admin\AppData\Local\Temp\{F021B863-9473-4467-93B2-6FC48C30E42F}\NS.inf" /log "C:\Program Files (x86)\NetSupport\NetSupport School\sec.log" /overwrite /quiet3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1852
-
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe"C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe" /Q "C:\Program Files (x86)\NetSupport\NetSupport School\Client32.ini"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2428 -
C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe"C:\Program Files (x86)\NetSupport\NetSupport School\pcicfgui_setup.exe"3⤵
- Executes dropped EXE
PID:1512
-
-
-
C:\Windows\Installer\MSI67B4.tmp"C:\Windows\Installer\MSI67B4.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport School\" /EI2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2716
-
-
C:\Windows\Installer\MSI6C29.tmp"C:\Windows\Installer\MSI6C29.tmp" /i "C:\Program Files (x86)\Common Files\NSL\nslsp64.dll"2⤵
- Executes dropped EXE
PID:2496
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{46de26ef-a718-50a4-271e-ea3e54f2f320}\gdihook5.inf" "9" "6d3d268df" "00000000000002C0" "WinSta0\Default" "00000000000004A4" "208" "c:\program files (x86)\netsupport\netsupport school"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1252
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\INF\oem2.inf" "gdihook5.inf:gdihook5.Mfg.NTamd64:gdihook5:11.11.0.704:pci_gdihook5_hwid" "6d3d268df" "00000000000002C0" "00000000000005E0" "00000000000005D8"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2360
-
C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" /* *1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2500 -
C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe"C:\Program Files (x86)\NetSupport\NetSupport School\client32.exe" * /VistaUI2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1996 -
C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe" /USER=SYSTEM3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2848
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe" /USER=SYSTEM3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2904
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"C:\Program Files (x86)\NetSupport\NetSupport School\runplugin.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592
-
-
C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"C:\Program Files (x86)\NetSupport\NetSupport School\runplugin64.exe"3⤵
- Executes dropped EXE
PID:2520
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD5bcb40e074206f5a199ee18ff53b8124b
SHA1be3c14a8f69425f9b6b243ba9a4f9cb83508064e
SHA256921a48ed8921aaacb59d9d81ffac6734d5ba61ebb4e4a0d397f63a3856561f1d
SHA51276848bf141f2a1f0c4fbd71733ce597e042fba22357a444555f73c356897372c62047bb91cd1059101fa9ceefef07ef31f3e985dda17cecb5a6e73f0259716e3
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetSupport School\NetSupport School Student Configurator.lnk
Filesize2KB
MD5c4faab894c751af237acf28dca007530
SHA17ba3d7e3dbfbb2e39f2221d459324f644f57c67f
SHA2563632f7f44b63c9b5eddfa972af8cfb0b66a963ff9a8d61129ffaeb73908c76bc
SHA512f93f34c22c53becf038264b6b2974264a230fbfe4ec20e541056d15402f9bca77cae9611c51739ab7d78d3fde45005a96d0d3911bc64fb3738db6c07c32a8850
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
4KB
MD5f5852af49823a9f89924f0d2ebfd23b0
SHA1163d69b57a7217e848e7c768411a8f4a10314603
SHA256aab2cb96d012b7bd981c73aea1ca34bc747a0ec7666456668f048f90fbf24550
SHA5127f9149157cbc568cfbf55453d0873bc1f68fae187e11e55eb05b5579691b6a6b5e48ce46051ab9601f059a8f2fc663bb2a6231863b7efdcd93e652468442682d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
397KB
MD51398b1605fa45565356bf3101f1171b6
SHA1e5b65dcdea8cbb57595cece96646632f31b9a537
SHA2563d42df344265d5c7463e158ed1aa2b42689ef17a804dff8c887e2f855d1a48ce
SHA5127c90f5eb358f64a502d5b10b6b1998280b14d12634ad50483b0e2ade0dbdd33deee0376a35815782260ee1b35af99d0c56462fe9561e84652609eefa97882a7e
-
Filesize
21KB
MD5a108f0030a2cda00405281014f897241
SHA1d112325fa45664272b08ef5e8ff8c85382ebb991
SHA2568b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
SHA512d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298
-
Filesize
5KB
MD56fbf86629f47eca07aaed1a95fc56777
SHA155fe7be7e600b74d5b67a66ce0d7c379c41bf550
SHA25632687c846ddb54be27dd5a4f2674ef4ce08b1d3cf8621301e36b319df28ecb26
SHA51289832543df122de7b0cb2cca77624e1f993b499f6d8bd514a2e86fae72867ae3e26f2c130cc216c9929d65ab7f55f93feafc549053f29157fcfd8061baf8cb84
-
Filesize
668B
MD50e04456a12f6ae6a7fd24dc070c6f33a
SHA1ef177d64b02af1f9edb6c3dd921741494ad563ce
SHA25641f458ad1e8c40755003d19e34bed49c2ae8752a9c332e5e6939a503726e0e4c
SHA512b4ce31250f2530406b8c556188f6ca718f08acf62aa4cdfc0597fc2b84889c1e89f85fca4751df89edcbd75d99614f7cb79f01a4a7d7de7c7a6490f11470a321
-
Filesize
444B
MD52f47b757cee157f49cc016c3466b4d70
SHA1f105ba94f7f02f8d2be9415de2d16bc816f42885
SHA256b711254e64091abbed9b8102bd119405d1264f35cfde0e3e9fb0c448a21588b9
SHA5128f5b9a43cfbb9705995394682431da5c167b6464c0dfa50f731564bb0de890e7a5be7a4aa0207b19fc790c31dac6289c13fb5d23099fdc75f7071d91c9b43b5b
-
Filesize
20B
MD5db9af7503f195df96593ac42d5519075
SHA11b487531bad10f77750b8a50aca48593379e5f56
SHA2560a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
SHA5126839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b
-
Filesize
25B
MD5c05c19b006d57dd4c90785cbe5c7877b
SHA134beebb832e53e4a3b9b3349919689fdf1401151
SHA25600e0c629d5645c15df66adcf99e8a0a3e517d7a7876141ae7a752f0585eec047
SHA512bede1e24476a12e9b1f29962254b19b357bfdfbe5c6eec9a2fca6c1b2105f4cec1d5872f6be269ef39d6e5cc542dc587ea9555ef87687bac64b3ff0de16c0f8c
-
Filesize
282B
MD539030ae352cc16a7fd0bf49261d97403
SHA1485f2944ead7b484a052c2f436ed950327bfc961
SHA25652703269ec26d1988de1efda21597a3faf563e980e1afc5434441ecd34d80ded
SHA5127c89c1263b693e0802379bfbbd785d354b0686f354abb2aa9f982b3c53dda316d7c584a3af0d4b3fc1a072c49986fa4b93a99b63d9dc2645f798ff8913a29a3d
-
Filesize
506B
MD5ff7c0d2dbb9195083bbabaff482d5ed6
SHA15c2efbf855c376ce1b93e681c54a367a407495dc
SHA256065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075
SHA512ea226b3a55fc59175136f104df497ebf5055624fb1c1c8073b249dfc5e1ed5818a6feee995aa82cf9ed050f1adc7a62994c90b1af03569dfe0d4551ee2bc70c9
-
Filesize
511KB
MD5d524b639a3a088155981b9b4efa55631
SHA139d8eea673c02c1522b110829b93d61310555b98
SHA25603d91c8cd20b846625a092a3dae6a12369930c65d6216a455a00449ebb0dc289
SHA51284f8ab54122f93a40da08fd83bca767ab49eb0f73c4ab274d9bda11dd09224134df011fa02e5a3abbafcc6fbef6a60673dd48feabdf829a1e22c85a2a759b7ac
-
Filesize
487KB
MD5d21afcbb8d2e5a043841b4d145af1df6
SHA1849db8ddad9e942bfe20a50666d17484b56a26e3
SHA256c9d4fd904650e4e53de4018951906c1434420d65cdb33e48c23b6c22bc9fdd4c
SHA512ecb8fbb2826f7f47eed46897701d42873b17b7599cd785ca54e900b793e3de1179c4d6441f317aa5298ae52c1c11157ae43b11822aa0076b9ec93ad5e46f0225
-
Filesize
153KB
MD5a1b7850763af9593b66ee459a081bddf
SHA16e45955fae2b2494902a1b55a3873e542f0f5ce4
SHA25641b8e92deba5206c78817236ed7f44df95636ca748d95fab05f032f5aec186af
SHA512a87a302a9a0d19d7ce293b42f5e7bc09664b21307a5321f226157fcc57eb2df2b59c6651878cb23969a182c82b55e8671ff00f8462194b81a907974a49cb25b1
-
Filesize
745KB
MD50228cb02aa58ef2876713130990c8ccf
SHA1f6766273a186b6911a6127fbb5af90125e267bbe
SHA2563651a2131f423c5c553476236be7ad4f26a63c67d872c3b9ecc135d1d184b1ed
SHA512a07664e639252a2bd34f42fb6907b95889d31657aa81fcdeea4b171bf3410bd3d56f5e404ee8fc16938d826f7cfffc46efcfe74126afec6e87cb048618d26e89
-
Filesize
244KB
MD5c4ca339bc85aae8999e4b101556239dd
SHA1d090fc385e0002e35db276960a360c67c4fc85cd
SHA2564ab23609cdc64d10b97c9ccb285ed7100f55d54d983cd50762da25ecac4357f9
SHA5129185ec32545fc838d7fef6c9e4dd222dd02114c661b0b344f16287d55e6571bfe7a4233a852acc579d07bcdbab18c5c034c465b1f4bb78535ed51c3499087fe0
-
Filesize
8KB
MD52d31ce5fe7cd81c996615ebcc29c058a
SHA14d74fe8e3170d36666df779e43fe8016986b154a
SHA256019290c9b7e5b48fb6de95f9563ed481cd42f8658451c6fbc8ad131d61209ce0
SHA512b8188481050630e7317d2f0687790a46e86f30a79f34164e4b02ec28da39334da80bd494a4f32ae8bb60fa2f01273cdcd9d15100f901517b0c01507678330052
-
Filesize
2KB
MD5703c7774b981e5d02e058340a27a5b75
SHA137534d7f0b31d2328d70ca578047d597273b73b6
SHA2564cfca868959f4e1b85bfd6b8a970ae06c0810d9c341f260df3ab8479089500e9
SHA512758e84915fa7ebb343bafd096bc40d9d226fe0da7c167b2b8e59f664e1be796143228bc3405df7e3447cdc918004db516344365d3d07a8e6c040df2b90456d78
-
Filesize
95KB
MD552b88eb20beb3b34a692a4cae0ff2196
SHA126a297b2baeb118f8856c1de41ee855572ba958a
SHA2562b675e9c27d3fb01cb9df2583b380de8dc8c0d5bbbe18af458f90b47c6d62b03
SHA51229567fc4db46d85f9ab8f6ecf2a708ec2c8def2e49eccd439daceda327b7411957b2014171a8370c3928d4a03a13bc6124d93678a87684370a5e6042d1c2ad6e
-
Filesize
68KB
MD59a348ed02f8b1efc9bfc5f53827f8a9c
SHA1c1f22705392af57b277d1fb4f46258dddffe8f33
SHA256641f2b86f013a95707ffdf0f584e3a83fedc1392cea3b546905b9ccb54ae10cf
SHA5129debb460fd74cb586ed66b7fa4bbb51a8e1184c1a061e81f4fd6f5e700fdb1e91b809a3f517fe55dd889f60df6ea29190455073dfa1cb5b85032b91efd12033f
-
Filesize
22KB
MD584dee0f25fe97868071202065dab63bb
SHA164a6c2e0d4561a726bdce5491d12693a96c45839
SHA256de5ace5c2a02afb01a90ba39b305a8f3c783883012432d22912910ead44ad60a
SHA512200a162cad66b4eaf94b02f31fa6986028b42ea4497d234131ce3f6b8154146c00881fc75f63b077b0ccdd47a62340440884eff2199f00d4f035622903fb8d1f
-
Filesize
8KB
MD5fb0bf8856762d27bb0e483b49451c78c
SHA1fe95d2837c4fba60a899c4d0a19a6a645d946444
SHA256ca95d830e08e4512bf2bd634940a51a17ef560338d3fdd1597d5f89fef112e50
SHA512bdd75c38659a55ae790cd23b3897640ec64163d89ba018045b63364122188db8ea58ae31ad1144195f28c8e2ffab87f64daf7c4c9ecad5cd6602dad89dea15a0
-
Filesize
169KB
MD50e6fda2b8425c9513c774cf29a1bc72d
SHA1a79ffa24cb5956398ded44da24793a2067b85dd0
SHA256e946b2fae0b36c43064463a8c16a2774adac30c4188c5af90e9338b903c501c9
SHA512285bb7759a1214abed36162ac8be2d48df17a05278c4de97562448e20fd43b635563a6819f37e23d92a5f5ed0205a68bffe43dac0d3a67513bd0303b4e7f89aa